A credit union’s promises in an outage are set by its architecture, years before the attack

The week

On June 29, 2024, Patelco Credit Union, a large California credit union based in Dublin, detected a ransomware attack and shut down several of its banking systems to contain it. Online and mobile banking, many electronic transfers and parts of its contact center went down. Through the week of July 8, digital banking stayed offline while the credit union posted regular public updates. According to those updates and local news reports, debit and credit cards, ATMs and branches kept working with limits. The credit union said it would waive overdraft, late and ATM fees and reimburse outage-related late fees charged elsewhere. Online banking and the mobile app came back on Monday, July 15, after more than two weeks. Some services, such as new accounts, loans and electronic statements, took longer. Whether member data had been stolen was not yet publicly settled that week.

For about two weeks after June 29, 2024, Patelco’s members experienced a ransomware attack as a list of things they could not do. Most of that list was written long before the attack. Members brought four questions, in roughly this order: can I use my money, what happened to my data, how do I get back in safely, and who pays for the harm. The answer to each depended mostly on design and policy decisions an institution makes in calm conditions. The response team could change the answers only at the margin.

Can I use my money?

Members do not care which server is down. They care whether a paycheck lands, whether rent goes out and whether the card works at the pharmacy. Those outcomes follow the wiring. Card authorizations and ATM withdrawals usually route through card processors and shared networks. Those can approve transactions on the issuer’s behalf within preset limits when the issuer is unreachable. Branch tellers work against the core. Online banking, bill pay and person-to-person transfers tend to sit closest to the systems a containment team switches off first. That pattern matches what Patelco’s updates described: cards and branches worked in limited form while digital channels were dark.

None of that is luck. It reflects choices about processor contracts, stand-in limits and network segmentation. An institution can make those choices on purpose. The starting point is a dependency map that ties each member function to the systems behind it, then asks a blunt question for each: if we isolate this system for two weeks, what stops? Tabletop exercises should run against that map, not against a generic ransomware scenario.

The map usually exposes a few cheap improvements. Stand-in limits can be set by member segment so that most members can still buy groceries and fuel. A status page can be hosted entirely outside the core environment. Branches can have a written manual procedure for urgent payments, such as rent or payroll for small business members. There are trade-offs. Higher stand-in limits mean more overdrafts to reconcile later. Every channel kept independent is another integration to secure, and it is useless if it shares administrator credentials with the network the attacker is in.

What happened to my data?

Availability and data exposure move on different clocks. In early July, Patelco’s public updates were about services. The data answer came later. The credit union’s August notice to individuals said an unauthorized party had first gained access on May 23, 2024. Its initial filing with the Maine attorney general counted about 726,000 affected people. An amended filing raised that to about 1.01 million. Forensic scope tends to widen like this, because investigators work outward from what they find first.

Members still need to hear something about their data in week one. The safest approach is two separate tracks. Service updates go out daily at a fixed time, even when little has changed. Data updates go out only when the investigation reaches a milestone, and say what is known and what is not. Early reassurance that there is no evidence of data theft is the statement most likely to be contradicted, so it should be avoided unless forensics are complete.

The regulatory clocks are separate again. Since September 1, 2023, federally insured credit unions must notify the NCUA within 72 hours of reasonably believing a reportable cyber incident has occurred. That notice goes to the regulator, not to members. State breach laws govern notice to individuals and set their own content and timing rules. Counsel should confirm which apply. The communication plan should pre-clear message templates with counsel so that the first data statement is not drafted under pressure.

How do I get back in safely?

Restoration is a fraud window. A publicized outage gives criminals a ready script, such as a text asking members to reactivate their account through a link. When digital banking returns, thousands of members log in at once. Some reset passwords, add payees or update contact details. That is exactly the activity an account takeover looks like.

A re-entry plan treats the first weeks back as a period of higher risk. Every message tells members that the credit union will not send login links and will not ask for codes. Step-up verification applies to new payees, changes of phone number or email, and large transfers for a defined period. Fraud monitoring rules are tuned for the surge rather than switched off to cut false positives. The contact center is staffed for the backlog, because transfers and payments queued during the outage will post in bulk. A published list of known posting issues answers questions before members call.

Who pays for the harm?

An outage creates real costs for members: late fees from other creditors, overdrafts caused by delayed deposits, missed loan payments. Patelco went further than waiving its own fees. It said it would reimburse late fees members incurred elsewhere because of the outage, and offered to write letters for members whose credit was affected. Once online banking returned, it said most of its own fees would be waived automatically for July and August. Those choices answer the questions every institution faces. Are waivers automatic or by request? Request-based relief floods the contact center and favors members who know to ask. Which third-party fees are reimbursed, and on what evidence? Who drafts the letter a member gives a landlord or lender?

Data exposure adds a second layer: identity protection services, call handling for worried members and, increasingly, litigation. These costs should be decided as policy before an incident. A board-approved remediation policy can set principles and delegate amounts to management. Finance should know which costs the cyber insurance policy covers, because coverage for customer remediation, notification and legal defense often sits under different sections with different limits. The answers members get then depend on a decision made months earlier, not on who answered the phone.

With hindsight

Patelco restored online banking and its app on July 15, 2024, and brought back remaining services over the following weeks. In mid-August the RansomHub group, which had claimed the attack, published stolen data. Patelco began notifying individuals on August 20. Its filings with the Maine attorney general first counted about 726,000 affected people, later amended to about 1.01 million, and it offered two years of identity protection. Class actions were filed within weeks of the attack. A $7.25 million class settlement received preliminary court approval in 2025, with a final approval hearing scheduled for 2026. Two features of the case have held up as the useful ones for other institutions. The data question was answered more than six weeks after the outage began, and the count grew after the first filing. Institutions that plan member communication around a single announcement are planning for a sequence that does not happen.